diff --git a/CHANGELOG.md b/CHANGELOG.md
index 92c8082..9a27d71 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@
 ## master
 * MQ error logs (in JSON or plain text) are now mirrored on stdout for the container.
 * `chkmqready` now waits until MQSC scripts in `/etc/mqm` have been applied
+* `chkmqready` and `chkmqhealthy` now run as the "mqm" user
 * Added ability to optionally use an alternative base image
 * Various build and test improvements
 
diff --git a/Dockerfile-server b/Dockerfile-server
index 8cb7f30..635fcfb 100644
--- a/Dockerfile-server
+++ b/Dockerfile-server
@@ -56,8 +56,9 @@ COPY --from=builder /go/src/github.com/ibm-messaging/mq-container/runmqserver /u
 COPY --from=builder /go/src/github.com/ibm-messaging/mq-container/chkmq* /usr/local/bin/
 COPY NOTICES.txt /opt/mqm/licenses/notices-container.txt
 
-RUN chmod +x /usr/local/bin/runmqserver \
-  && chmod +x /usr/local/bin/chkmq*
+RUN chmod ug+x /usr/local/bin/runmqserver \
+  && chown mqm:mqm /usr/local/bin/*mq* \
+  && chmod ug+xs /usr/local/bin/chkmq*
 
 # Always use port 1414
 EXPOSE 1414